chha

Also a short video on https://www.youtube.com/watch?v=fEudbAjschs

...or that the satellite network connection disconnects for some reason.

Also on Wikipedia: https://en.wikipedia.org/wiki/As_We_May_Think

The machine: https://en.wikipedia.org/wiki/Memex

In Norwegian; gives an overview of how much artists made from your Spotify usage.

The EU already has. GDPR and the AI Act puts a lot of limits on what you can do in the open space, although it doesn't always go far enough.

So true. Can't wait for NIS2 to be implemented in my location (EU); the new directive allows authorities to hold board members and CEOs personally responsible for cybersec fails (although only as a last resort, after trying other means).

The belt packs typically do a lot more than to amplify ambient noise, they also handle RF, depending on the model decryption of the audio signal, EQ as well as other stuff. All while typically running on 2x1,5V AA batteries.

Audio gear isn't made to last long on batteries, it's made to be reliable for the hours a show typically lasts. I worked part-time as a sound tech (paid hobby) for 15+ years, and I never started a show without fresh batteries, regardless of what the indicators on the transmitters/receivers told me.

Been a while since I looked into this, but afaik Maven Central is run by Sonatype, which happens to be one of the major players for systems related to Supply Chain Security.

From what I remember (a few years old, things may have changed) they required devs to stage packages to a specific test env, packages were inspected not only for malware but also vulnerabilities before being released to the public.

NPM on the other hand... Write a package -> publish. Npm might scan for malware, they might do a few additional checks, but at least back when I looked into it nothing happened proactively.

It depends. If they simply ignore the ruling, my guess is that whatever trade agreements are in place have a mechanism for escalating such violations so that an Israeli court can enforce the order. I also take for granted that it depends a lot on the political climate and the strategic value for the governments of Israel and the US...

Similar to the Shai Hulud attack, but with more sofisticated C2 (blockchain, Google Calendar). It also uses Unicode characters to hide source code in IDEs, harvests ecosystem credentials to infect and publish new versions of packages you have access to, and more.

There could, this would essentially be in the form of a standard library. That would work until someone decides they don't like the form/naming conventions/architecture/ideology/lack of ideology/whatever else and then reinvent everything to do the same, but in a slightly different way.

And before you know it, you have a multitude of distributions to choose from, each with their own issues...

Fines are based on a number of things; the type of data (PII or Article-9-PII), number of people affected, amount of data, previous violations, and as far as I know also the country issuing the fine. 6.5M might be a small fine by some standards, but if fined and nothing improves the fine is likely to be a lot higher the next time around.

It doesn't say audited environments as such, but you are required to use secure environments that you control as a basis. What "secure" means can always be discussed, but in general it depends on what data you process and what you do with it; if it is a large volume/big population/article 9-data auditable environments should be expected - though not publicly auditable. Although that would be nice...

Fully agree on what you are saying, and my popcorn is ready for August when the penalties part of the AI Act comes into force. There is a grace period for two years for certain systems already on the market, but any new model introduced after August this year has to be compliant. AI Act+GDPR will be a great show to watch...

> Deliberately extracting personal data into un-audited environments without good reason (eg printing a label for shipping), should be punished with GDPR-style global turnover-based penalties and jail for those responsible.

There already are, but only for Europeans through the GDPR.

Sorry for that, guess I'm just too used to the common misconception some people have that the GDPR doesn't apply if a company isn't established in the EU.

In this case 23andMe is on the Data Privacy Framework list, so they have volunteered to follow the GDPR while still being based in the US. This is basically the same as a number of other GDPR cases, including the GDPR fine against Clearview AI. Fining 23andMe if they violate GDPR should be trivial in that case.

Sure they can. GDPR article 2 (2) says:

«This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;»

So the GDPR applies. The EU can of course sanction violators outside, but given the current political climate it is likely to be more difficult than before.

Absolutely. A bunch of them also predated the www, or started just when the www was gaining popularity, meaning that information on possible products might be more limited than it is today. Some have narrow use-cases, and some might have started as really narrow in terms of scope, but then ballooned after gaining popularity, sales (and feature requests), and some probably started because the alternative was deemed too expensive compared to just making it in-house.

I think the main point bob1029 was trying to make is that it can be worthwhile doing somehting in-house if the alternatives doesn't match the use-case, are too expensive or whatever else - but that you seriously need to consider if your architecture is the best way to solve the problem before going down that route.

The AI Act classifies systems depending on their capabilities and their intended use, and the risk that they pose on the people using or being exposed to them. If a tool ends up being classified as a high-risk AI system or as a model with systemic risk there are strict requirements in terms of reporting incidents. For certain types of incidents it is as little as two days, for others upwards of 15 days.

"I think this is the quickest way of clearing my overdraft"

That statement from Michael Eavis (founder of the festival) kind of hits home with a recent story from The Independent in how bands are settling for less, or even paying to play at the festival - as an investment. Being shown on the BBC as part of their coverage can make or break the experience (and their economy).

https://www.independent.co.uk/arts-entertainment/music/featu...

Even though this doesn't apply to enterprise customers, I'm just waiting for European customers to wake up and realize that ChatGPT isn't compatible with the GDPR today. And if the court suddenly decides that enterprise customers should also be part of the preservation order it'll be a big hit for OpenAI.

Translated story: https://www-nrk-no.translate.goog/norge/dnb-navnet-misbrukt-...

One of the biggest Norwegian banks were used as a cover for a scam in Portugal, involving 2500 ad posters distributed by advertising company JCDecaux, with QR-codes linking to scam sites. The ad campaign cost around 5M NOK ($~0.5 USD), and the victims were tricked into signing up for various loans and investment programs, with lots of extra fees added on top.

No, this appears to be for something similarly named for the Nintendo Wii

This!

Get rid of any unwanted noise caused by gear or environment. Add a basic EQ - I'm using a 15-band one just to compensate for the room, the speakers, hearing loss and anything else that would impact the sound.

But how many of those will send conscripts abroad to fight? Norway won't, they rely on volunteers who have at least completed conscription or proffessional soldiers. Can't imagine that any of the others does it differently.

Link to the live concert (timestamped to the robotic conductor): https://www.youtube.com/live/UQLmBXbK_CU?si=3mJ0azT2bZxY_toe...

Reminded me of Crash at Crush [1]; another deliberate train crash.

[1]: https://en.m.wikipedia.org/wiki/Crash_at_Crush

> If you're a security practitioner, teaching yourself how to hack is also part of the "Hacking is Cool" dumb idea. Think about it for a couple of minutes: teaching yourself a bunch of exploits and how to use them means you're investing your time in learning a bunch of tools and techniques that are going to go stale as soon as everyone has patched that particular hole.

If only this was true... Injection has been on Owasp Top 10 since its inception, and is unlikely to go away anytime soon. Learning some techniques can be useful just to do quick assessments of basic attack vectors, and to really understand how you can protect yourself.

I was about to ask for the same thing. All best practices within the security domain point towards multiple layers of security, simply to have some fallback if one mechanism is compromised.

One of the first things you need to think about is the inclusion criteria.

Wikipedia bases all its content on the following: "A topic is presumed to be suitable for a stand-alone article or list when it has received significant coverage in reliable sources that are independent of the subject."

This is flexible enough to allow a lot of stuff, but also causes endless debates, discussions and complaints when content is removed. This is (in my opinion) one of the things that actually give Wikipedia value. If everything is permitted, separating spam from actual content is hopeless.

Defining a scope for your application is a must; if you gain even the slightest popularity, every self-serving developer is going to try to piggyback on you. "See, my project is listed on xyz, therefore it's famous and hence I'm a rockstar."

-Do you want to include any project hosted anywhere? -Incomplete/unfinished projects? -Forks? -Do you want to limit yourself to particular licenses? -What about ecosystems such as PyPi, Nuget, npm and all the rest? Code is mainly hosted on github, but do you want to maintain any kind of relation between source and package?

I think this could be handy, both for finding alternatives if you have an issue with a library or if you're looking for "something" that does <abc>.

We tend to avoid using github repos, but go for published packages from the usual sites; Nuget, Pypi, Npm etc, using Repository and Firewall from Sonatype to act as a proxy between us and the package repos. All packages are analyzed and tagged with various metadata by Sonatype. Firewall lets us define policies for what we can use, and will filter out everything else.

This only works for published dependencies, but based on a couple years experience it works really well. No issues with malware (so far), we don't let packages with known vulns into our codebases and we are notified if a vuln is discovered in something we use.